Deobfuscate/Decode Files or Information

ABK has the ability to decrypt AES encrypted payloads.^[5]

Action RAT can use Base64 to decode actor-controlled C2 server communications.^[6]

Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.^[7]

Agrius has deployed base64-encoded variants of ASPXSpy to evade detection.^[8]

Amadey has decoded antivirus name strings.^[9]

Apostle compiled code is obfuscated in an unspecified fashion prior to delivery to victims.^[8]

AppleJeus has decoded files received from a C2.^[10]

AppleSeed can decode its payload prior to execution.^[11]

An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.^[12]

An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.^[13][14]

During APT28 Nearest Neighbor Campaign, APT28 unarchived data using the GUI version of WinRAR.^[15]

APT38 has used the RC4 algorithm to decrypt configuration data. ^[16]

APT39 has used malware to decrypt encrypted CAB files.^[17]

ArcaneDoor involved the use of Base64 obfuscated scripts and commands.^[18]

Aria-body has the ability to decrypt the loader configuration and payload DLL.^[19]

Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code. ^[20][21]

AuditCred uses XOR and RC4 to perform decryption on the code functions.^[22]

Avaddon has decrypted encrypted strings.^[23]

Avenger has the ability to decrypt files downloaded from C2.^[5]

AvosLocker has deobfuscated XOR-encoded strings.^[24]

Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.^[25][26]

Babuk has the ability to unpack itself into memory using XOR.^[27][28]

BabyShark has the ability to decode downloaded files prior to execution.^[29]

BackConfig has used a custom routine to decrypt strings.^[30]

BADFLICK can decode shellcode using a custom rotating XOR cipher.^[31]

Bandook has decoded its PowerShell script.^[32]

Bankshot decodes embedded XOR strings.^[33]

Bazar can decrypt downloaded payloads. Bazar also resolves strings and other artifacts at runtime.^[34][35]

BBK has the ability to decrypt AES encrypted payloads.^[5]

BBSRAT uses Expand to decompress a CAB file into executable content.^[36]

BendyBear has decrypted function blocks using a XOR key during runtime to evade detection.^[37]

Bisonal has decoded strings in the malware using XOR and RC4.^[38][39]

BlackByte has encoded commands in base64-encoded sections concatenated together in PowerShell.^[40] BlackByte uses PowerShell commands to disable Windows Defender.^[41]

BlackByte Ransomware is distributed as an obfuscated JavaScript launcher file.^[42]

BLINDINGCAN has used AES and XOR to decrypt its DLLs.^[43]

BoomBox can decrypt AES-encrypted files downloaded from C2.^[44]

BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.^[45]

BRONZE BUTLER downloads encoded payloads and decodes them on the victim.^[46]

Brute Ratel C4 has the ability to deobfuscate its payload prior to execution.^[47]

Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts.^[48][49]

Bundlore has used openssl to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.^[50]

BUSHWALK can Base64 decode and RC4 decrypt malicious payloads sent through a web request’s command parameter.^[51][52]

During C0017, APT41 used the DUSTPAN loader to decrypt embedded payloads.^[53]

During C0021, the threat actors deobfuscated encoded PowerShell commands including use of the specific string 'FromBase'+0x40+'String', in place of FromBase64String which is normally used to decode base64.^[54][55]

Carbon decrypts task and configuration files for execution.^[56][57]

Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.^[58]

certutil has been used to decode binaries hidden inside certificate files as Base64 information.^[1]

Chaes has decrypted an AES encrypted binary file to trigger the download of other files.^[59]

CharmPower can decrypt downloaded modules prior to execution.^[60]

CHIMNEYSWEEP can use an embedded RC4 key to decrypt Windows API function strings.^[61]

The Chinoxy dropping function can initiate decryption of its config file.^[62]

Chrommme can decrypt its encrypted internal code.^[63]

Cinnamon Tempest has used weaponized DLLs to load and decrypt payloads.^[64]

Clambling can deobfuscate its payload prior to execution.^[65][66]

Clop has used a simple XOR operation to decrypt strings.^[67]

COATHANGER decodes configuration items from a bundled file for command and control activity.^[68]

Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.^[69][70]

CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.^[71]

ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.^[72][73]

Conti has decrypted its payload using a hardcoded AES-256 key.^[74][75]

CookieMiner has used Google Chrome's decryption and extraction operations.^[76]

CostaBricks has the ability to use bytecode to decrypt embedded payloads.^[77]

Crimson can decode its encoded PE file prior to execution.^[78]

Cuckoo Stealer strings are deobfuscated prior to execution.^[79][80]

Cyclops Blink can decrypt and parse instructions sent from C2.^[81]

DanBot can use a VBA macro to decode its payload prior to installation and execution.^[82]

DarkGate installation includes binary code stored in a file located in a hidden directory, such as shell.txt, that is decrypted then executed.^[83] DarkGate uses hexadecimal-encoded shellcode payloads during installation that are called via Windows API CallWindowProc() to decode and then execute.^[84]

Darkhotel has decrypted strings and imports using RC4 during execution.^[85][86]

DarkTortilla can decrypt its payload and associated configuration elements using the Rijndael cipher.^[87]

DarkWatchman has the ability to self-extract as a RAR archive.^[88]

DDKONG decodes an embedded configuration using XOR.^[89]

DEADEYE has the ability to combine multiple sections of a binary which were broken up to evade detection into a single .dll prior to execution.^[53]

DEADWOOD XORs some strings within the binary using the value 0xD5, and deobfuscates these items at runtime.^[8]

Denis will decrypt important strings used for C&C communication.^[90]

DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.^[91]

Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.^[92]

Dtrack has used a decryption routine that is part of an executable physical patch.^[93]

DUSTPAN decodes and decrypts embedded payloads.^[94]

DUSTTRAP deobfuscates embedded payloads.^[94]

Dyre decrypts resources needed for targeting the victim.^[95][96]

Earth Lusca has used certutil to decode a string into a cabinet file.^[97]

Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.^[98]

Ecipekac has the ability to decrypt fileless loader modules.^[99]

Egregor has been decrypted before execution.^[100][101]

Emotet has used a self-extracting RAR file to deliver modules to victims. Emotet has also extracted embedded executables from files using hard-coded buffer offsets.^[102]

EnvyScout can deobfuscate and write malicious ISO files to disk.^[44]

Exaramel for Linux can decrypt its configuration file.^[103]

Exbyte decodes and decrypts data stored in the configuration file with a key provided on the command line during execution.^[104]

Expand can be used to decompress a local or remote CAB file into an executable.^[105]

FatDuke can decrypt AES encrypted C2 communications.^[106]

FIN13 has utilized certutil to decode base64 encoded versions of custom malware.^[107]

Final1stspy uses Python code to deobfuscate base64-encoded strings.^[108]

FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.^[109][110]

FIVEHANDS has the ability to decrypt its payload prior to execution.^{[111][112][113]}

FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.^[114]

FRAMESTING can decompress data received within POST requests.^[51]

During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.^[115]

FYAnti has the ability to decrypt an embedded .NET module.^[99]

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader.^[116][117] Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.^[118]

Gelsemium can decompress and decrypt DLLs and shellcode.^[63]

gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.^[119]

GLASSTOKEN has the ability to decode hexadecimal and Base64 C2 requests.^[120]

GoldMax has decoded and decrypted the configuration file when executed.^[121][122]

Goopy has used a polymorphic decryptor to decrypt itself at runtime.^[90]

Gootloader has the ability to decode and decrypt malicious payloads prior to execution.^[123][124]

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.^[125]

Grandoreiro can decrypt its encrypted internal strings.^[126]

Green Lambert can use multiple custom routines to decrypt strings prior to execution.^[127][128]

GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.^[129]

Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. Hancitor has also extracted executables from ZIP files.^[130][131]

HermeticWiper can decompress and copy driver files using LZCopy.^[132]

Heyoka Backdoor can decrypt its payload prior to execution.^[133]

HiddenWasp uses a cipher to implement a decoding function.^[134]

Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.^[135][136]

Hildegard has decrypted ELF files with AES.^[137]

HUI Loader can decrypt and load files containing malicious payloads.^[138]

HyperBro can unpack and decrypt its payload prior to execution.^[65][139]

IceApple can use a Base64-encoded AES key to decrypt tasking.^[140]

Imminent Monitor has decoded malware components that are then dropped to the system.^[141]

INC Ransomware can run CryptStringToBinaryA to decrypt base64 content containing its ransom note.^[142]

Industroyer decrypts code to connect to a remote C2 server.^[143]

InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.^[144][145]

IronNetInjector has the ability to decrypt embedded .NET and PE payloads.^[146]

ISMInjector uses the certutil command to decode a payload file.^[147]

During Juicy Mix, OilRig used a script to concatenate and deobfuscate encoded strings in Mango.^[148]

Kapeka utilizes obfuscated JSON structures for various data storage and configuration management items.^[149]

Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.^[150]

Kerrdown can decode, decrypt, and decompress multiple layers of shellcode.^[151]

Kessel has decrypted the binary's configuration once the main function was launched.^[152]

KEYPLUG can decode its configuration file to determine C2 protocols.^[53]

KGH_SPY can decrypt encrypted strings and write them to a newly created folder.^[153]

Kimsuky has decoded malicious VBScripts using Base64.^[154]

Kobalos decrypts strings right after the initial communication, but before the authentication process.^[155]

KOCTOPUS has deobfuscated itself before executing its commands.^[156]

KONNI has used certutil to download and decode base64 encoded strings and has also devoted a custom section to performing all the components of the deobfuscation process.^[157][158]

Kwampirs decrypts and extracts a copy of its main DLL payload when executing.^[159]

Latrodectus has the ability to deobfuscate encrypted strings.^{[160][161][162]}

Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.^[163][164]

Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.^[165]

LightNeuron has used AES and XOR to decrypt configuration files and commands.^[166]

LIGHTWIRE can RC4 decrypt and Base64 decode C2 commands.^[51]

Line Dancer shellcode payloads are base64 encoded when transmitted to compromised devices.^[167]

LiteDuke has the ability to decrypt and decode multiple layers of obfuscation.^[106]

Lizar can decrypt its configuration data.^[168]

LockBit 2.0 can decode scripts and strings in loaded modules.^[169][170]

The LockBit 3.0 payload is decrypted at runtime.^{[171][172][173]}

Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.^[174]

LookBack has a function that decrypts malicious data.^[175]

Lucifer can decrypt its C2 address upon execution.^[176]

Lumma Stealer has used Base64-encoded content during execution, decoded via PowerShell.^[177]

LunarLoader can deobfuscate files containing the next stages in the infection chain.^[178]

LunarMail can decrypt strings to retrieve configuration settings.^[178]

LunarWeb can decrypt strings related to communication configuration using RC4 with a static key.^[178]

Machete’s downloaded data is decrypted using AES.^[179]

MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.^[180]

Mafalda can decrypt files and data.^[181]

MagicRAT stores command and control URLs using base64 encoding in the malware's configuration file.^[182]

Malteiro has the ability to deobfuscate downloaded files prior to execution.^[183]

MegaCortex has used a Base64 key to decode its components.^[184]

menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.^[185][186]

After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files. ^[187]

metaMain can decrypt and load other modules.^[181]

Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.^{[188][189][190]}

MirageFox has a function for decrypting data containing C2 configuration information.^[191]

Mispadu decrypts its encrypted configuration files prior to execution.^[183][192]

Molerats decompresses ZIP files once on the victim machine.^[193]

Mongall has the ability to decrypt its payload prior to execution.^[133]

Moonstone Sleet delivered payloads using multiple rounds of obfuscation and encoding to evade defenses and analysis.^[194]

More_eggs will decode malware components that are then dropped to the system.^[195]

Mori can resolve networking APIs from strings that are ADD-encrypted.^[196]

MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript.^{[197][198][199][200]}

NativeZone can decrypt and decode embedded Cobalt Strike beacon stage shellcode.^[44]

Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.^[201]

Nightdoor stores network configuration data in a file XOR encoded with the key value of 0x7A.^[202]

The Ninja loader component can decrypt and decompress the payload.^[203][204]

NOKKI uses a unique, custom de-obfuscation technique.^[205]

ODAgent can Base64-decode and XOR decrypt received C2 commands.^[206]

OilBooster can Base64-decode and XOR-decrypt C2 commands taken from JSON files.^[206]

A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.^{[207][147][208][209]}

Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.^[210]

OnionDuke can use a custom decryption algorithm to decrypt strings.^[106]

OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.^[208]

During Operation Dust Storm, attackers used VBS code to decode payloads.^[211]

During Operation Honeybee, malicious files were decoded prior to execution.^[212]

For Operation Spalax, the threat actors used a variety of packers and droppers to decrypt malicious payloads.^[213]

OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads.^[214] Versions of OSX/Shlayer pass encrypted and password-protected code to openssl and then write the payload to the /tmp folder.^[215][216]

OSX_OCEANLOTUS.D uses a decode routine combining bit shifting and XOR operations with a variable key that depends on the length of the string that was encoded. If the computation for the variable XOR key turns out to be 0, the default XOR key of 0x1B is used. This routine is also referenced as the rotate function in reporting.^[217]

P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.^[103]

PcShare has decrypted its strings by applying a XOR operation and a decompression using a custom implemented LZM algorithm.^[62]

Pikabot decrypts command and control URIs using ADVobfuscator, and decrypts IP addresses and port numbers with a custom algorithm.^[218] Other versions of Pikabot decode chunks of stored stage 2 payload content in the initial payload .text section before consolidating them for further execution.^[219] Overall LunarMail is associated with multiple encoding and encryption mechanisms to obfuscate the malware's presence and avoid analysis or detection.^[220]

Pillowmint has been decompressed by included shellcode prior to being launched.^[221]

PingPull can decrypt received data from its C2 server by using AES.^[222]

PipeMon can decrypt password-protected executables.^[223]

PITSTOP can deobfuscate base64 encoded and AES encrypted commands.^[52]

PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.^{[224][65][225]}

PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.^[226]

PolyglotDuke can use a custom algorithm to decrypt strings used by the malware.^[106]

PowerExchange can decode and decrypt C2 commands received via email.^[227]

PowerLess can use base64 and AES ECB decryption prior to execution of downloaded modules.^[228]

POWERSTATS can deobfuscate the main backdoor code.^[199]

PowGoop can decrypt PowerShell scripts for execution.^[196][229]

Proton uses an encrypted file to store commands and configuration values.^[230]

PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.^[77]

Pteranodon can decrypt encrypted data strings prior to using them.^[231]

PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.^[232]

PyDCrypt has decrypted and dropped the DCSrv payload to disk.^[233]

QakBot can deobfuscate and re-assemble code strings for execution.^{[234][235][236]}

QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.^[237]

QUIETCANARY can use a custom parsing routine to decode the command codes and additional parameters from the C2 before executing them.^[238]

Raccoon Stealer uses RC4-encrypted, base64-encoded strings to obfuscate functionality and command and control servers.^[239][240]

Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.^[241][242]

RainyDay can decrypt its payload via a XOR key.^[243]

Ramsay can extract its agent from the body of a malicious document.^[244]

RansomHub can use a provided passphrase to decrypt its configuration file.^[245]

RAPIDPULSE listens for specific HTTP query parameters in received communications. If specific parameters match, a hard-coded RC4 key is used to decrypt the HTTP query paremter hmacTime. This decrypts to a filename that is then open, read, encrypted with the same RC4 key, base64-encoded, written to standard out, then passed as a response to the HTTP request.^[246]

Raspberry Robin contains several layers of obfuscation to hide malicious code from detection and analysis.^[247]

RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.^[248]

RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.^[106]

Remexi decrypts the configuration data using XOR with 25-character keys.^[249]

REvil can decode encrypted strings to enable execution of commands and payloads.^{[250][251][252][253][254][255]}

RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.^[256]

Rising Sun has decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.^[257]

ROADSWEEP can decrypt embedded scripts prior to execution.^[61][258]

Rocke has extracted tar.gz files after downloading them from a C2 server.^[259]

RogueRobin decodes an embedded executable using base64 and decompresses it.^[260]

ROKRAT can decrypt strings using the victim's hostname as the key.^[261][262]

RotaJakiro uses the AES algorithm, bit shifts in a function called rotate, and an XOR cipher to decrypt resources required for persistence, process guarding, and file locking. It also performs this same function on encrypted stack strings and the head and key sections in the network packet structure used for C2 communications.^[263]

Sagerunex uses a custom decryption routine to unpack itself during installation.^[264]

Saint Bot can deobfuscate strings and files for execution.^[265]

SampleCheck5000 can decode and decrypt command line strings and files received through C2.^[148][206]

Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.^[266][267]

Sardonic can first decrypt with the RC4 algorithm using a hardcoded decryption key before decompressing.^[268]

SDBbot has the ability to decrypt and decompress its payload to enable code execution.^[269][270]

ShadowPad has decrypted a binary blob to start execution.^[271]

Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.^[272]

Shark can extract and decrypt downloaded .zip files.^[273]

SharpStage has decompressed data received from the C2 server.^[274]

ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.^[275]

Sibot can decrypt data received from a C2 and save to a file.^[121]

SideTwist can decode and decrypt messages received from C2.^[276]

Siloscape has decrypted the password of the C2 server with a simple byte by byte XOR. Siloscape also writes both an archive of Tor and the unzip binary to disk from data embedded within the payload using Visual Studio’s Resource Manager.^[277]

Skidmap has the ability to download, unpack, and decrypt tar.gz files .^[278]

SLIGHTPULSE can deobfuscate base64 encoded and RC4 encrypted C2 messages.^[279]

Smoke Loader deobfuscates its code.^[280]

Snip3 can decode its second-stage PowerShell script prior to execution.^[281]

During the SolarWinds Compromise, APT29 used 7-Zip to decode their Raindrop malware.^[241]

SombRAT can run upload to decrypt and upload files from storage.^[77][112]

SoreFang can decode and decrypt exfiltrated data sent to C2.^[282]

Spark has used a custom XOR algorithm to decrypt the payload.^[283]

Upon execution Spica can decode an embedded .pdf and write it to the desktop as a decoy document.^[284]

SQLRat has scripts that are responsible for deobfuscating additional scripts.^[285]

Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm.^[286][287]

Starloader decrypts and executes shellcode from a file called Stars.jps.^[288]

STEADYPULSE can URL decode key/value pairs sent over C2.^[279]

StealBit can deobfuscate loaded modules prior to execution.^[169][289]

Storm-1811 has distributed password-protected archives such as ZIP files during intrusions.^[290]

StrelaStealer payloads have included strings encrypted via XOR.^[291] StrelaStealer JavaScript payloads utilize Base64-encoded payloads that are decoded via certutil to create a malicious DLL file.^[292][293]

Stuxnet decrypts resources that are loaded into memory and executed.^[294]

SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs.^[295]

SysUpdate can deobfuscate packed binaries in memory.^[139]

TA505 has decrypted packed DLLs with an XOR key.^[296]

Taidoor can use a stream cipher to decrypt stings used by the malware.^[297]

TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.^[298]

TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.^{[299][300][242]}

During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.^[301]

ThreatNeedle can decrypt its payload using RC4, AES, or one-byte XORing.^[302]

Torisma has used XOR and Base64 to decode C2 data.^[303]

TrickBot decodes the configuration data and modules.^{[304][305][306]}

Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.^[307][308]

TSCookie has the ability to decrypt, load, and execute a DLL and its resources.^[309]

Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.^[310]

Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.^[311]

One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".^[312]

UPSTYLE encodes its main content prior to loading via Python as base64-encoded blobs.^[313][314]

Uroburos can decrypt command parameters sent through C2 and use unpacking code to extract its packed executable.^[315]

Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.^[316]

Valak has the ability to decode and decrypt downloaded files.^[317][318]

VaporRage can deobfuscate XOR-encoded shellcode prior to execution.^[44]

VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.^[319]

Volgmer deobfuscates its strings and APIs once its executed.^[320]

Volt Typhoon has used Base64-encoded data to transfer payloads and commands, including deobfuscation via certutil.^[321]

WarzoneRAT can use XOR 0x45 to decrypt obfuscated code.^[322]

WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.^[323]

Water Curupira Pikabot Distribution used highly obfuscated JavaScript files as one initial installer for Pikabot.^[324]

Waterbear has the ability to decrypt its RC4 encrypted payload for execution.^[325]

WellMail can decompress scripts received from C2.^[326]

WellMess can decode and decrypt data received from C2.^{[327][328][329]}

WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.^[330][331]

WindTail has the ability to decrypt strings using hard-coded AES keys.^[332]

Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.^[333]

The Winnti for Windows dropper can decrypt and decompresses a data blob.^[334]

Winter Vivern delivered exploit payloads via base64-encoded payloads in malicious email messages.^[335]

WIREFIRE can decode, decrypt, and decompress data received in C2 HTTP POST requests.^[336]

WIRTE has used Base64 to decode malicious VBS script.^[337]

Woody RAT can deobfuscate Base64-encoded strings and scripts.^[338]

xCaon has decoded strings from the C2 server before executing commands.^[339]

XLoader uses XOR and RC4 algorithms to decrypt payloads and functions.^[340] XLoader can be distributed as a self-extracting RAR archive that launches an AutoIT loader.^[341]

YAHOYAH decrypts downloaded files before execution.^[342]

Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.^[343][344]

ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.^[345]

Zeus Panda decrypts strings in the code during the execution process.^[346]

ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.^[347]

ZxxZ has used a XOR key to decrypt strings.^[348]